Defending Against Adversarial Machine Learning

TL;DR

This paper analyzes adversarial machine learning attacks and proposes defense strategies such as model switching and input distribution detection to protect systems like authorship attribution from adversarial manipulation.

Contribution

It introduces methods for defending authorship attribution systems against adversarial attacks, including input distribution monitoring and random model switching.

Findings

Defense via model switching reduces attack success.

Input distribution detection identifies adversarial inputs.

Multiple machine learning models are evaluated for attack resilience.

Abstract

An Adversarial System to attack and an Authorship Attribution System (AAS) to defend itself against the attacks are analyzed. Defending a system against attacks from an adversarial machine learner can be done by randomly switching between models for the system, by detecting and reacting to changes in the distribution of normal inputs, or by using other methods. Adversarial machine learning is used to identify a system that is being used to map system inputs to outputs. Three types of machine learners are using for the model that is being attacked. The machine learners that are used to model the system being attacked are a Radial Basis Function Support Vector Machine, a Linear Support Vector Machine, and a Feedforward Neural Network. The feature masks are evolved using accuracy as the fitness measure. The system defends itself against adversarial machine learning attacks by identifying inputs that do not match the probability distribution of normal inputs. The system also defends itself against adversarial attacks by randomly switching between the feature masks being used to map system inputs to outputs.